CVE-2025-0890
📋 TL;DR
This vulnerability involves insecure default credentials for the Telnet function in Zyxel VMG4325-B10A DSL CPE devices. Attackers can log into the management interface if administrators fail to change default credentials after deployment. This affects users of legacy Zyxel DSL CPE devices with vulnerable firmware.
💻 Affected Systems
- Zyxel VMG4325-B10A DSL CPE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to reconfigure network settings, intercept traffic, install malware, or use device as pivot point into internal network.
Likely Case
Unauthorized access to management interface leading to network configuration changes, service disruption, or credential harvesting.
If Mitigated
No impact if default credentials were changed during initial setup or if Telnet access is disabled.
🎯 Exploit Status
Exploitation requires only Telnet access and knowledge of default credentials. No special tools or skills needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Restart Required: No
Instructions:
No firmware patch available. Follow vendor advisory recommendations: 1. Change default credentials immediately. 2. Disable Telnet if not needed. 3. Consider replacing legacy devices.
🔧 Temporary Workarounds
Change Default Credentials
allImmediately change default Telnet credentials to strong, unique passwords
Login to device management interface via web or console
Navigate to Administration > User Accounts
Change default admin password to complex password
Disable Telnet Service
allDisable Telnet access if not required for operations
Login to device management interface
Navigate to Management > Access Control
Disable Telnet service
Enable SSH instead if remote access needed
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable devices from critical systems
- Deploy network access controls to restrict Telnet traffic to authorized management stations only
🔍 How to Verify
Check if Vulnerable:
Attempt Telnet connection to device on port 23 using default credentials. If login succeeds, device is vulnerable.Check Version:
Check firmware version in web interface under Maintenance > System Info or via console command 'show version'Verify Fix Applied:
Attempt Telnet login with default credentials - should fail. Verify new credentials work and old ones don't.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful login
- Multiple Telnet connection attempts from single source
- Configuration changes from unexpected sources
Network Indicators:
- Telnet traffic to device management interface
- Brute force patterns on port 23
- Unexpected outbound connections from device
SIEM Query:
source_port=23 AND (event_type="authentication_success" OR event_type="configuration_change")